# A weird security bug

**URL:** <https://community.weweb.io/t/a-weird-security-bug/1248>\
**Category:** How do I?\
**Created:** [October 6, 2022, 8:22pm UTC](https://community.weweb.io/t/a-weird-security-bug/1248 "2022-10-06T20:22:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![tjmcdonough](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tjmcdonough](https://community.weweb.io/u/tjmcdonough)\
**Post date:** [October 6, 2022, 8:22pm UTC](https://community.weweb.io/t/a-weird-security-bug/1248/1 "2022-10-06T20:22:09Z")

</div>

I have just found quite a worrying security bug. I am using token-based auth and have just deployed my application for the first time. The login fails with a 401 (but it works within the editor) then the username and password gets logged out as plaintext in the URL.

![image (5)](https://us1.discourse-cdn.com/flex016/uploads/weweb/original/2X/9/910cf7bdb25540ff998ca5cbcf0a3ed3841206b7.png)